Vector35 / Vector35/binaryninja-api

Ability to found `or`ed constants even if no enumeration type is set

Open
#4,912 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Component: Core Effort: Low Impact: Medium
Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

I'm not sure if this is a bug or missing feature. In the example below 0xf0 actually means PAGE_EXECUTE_WRITECOPY|PAGE_EXECUTE_READWRITE|PAGE_EXECUTE_READ|PAGE_EXECUTE but I cannot set that value to enumeration. It would be very useful if BN can do that when I try to set enumeration with M shortcut.

int64_t query_mem_info(int64_t addr)

MEMORY_BASIC_INFORMATION lpBuffer
VirtualQuery(addr, &lpBuffer, 0x30)

if (lpBuffer.State == MEM_COMMIT && (lpBuffer.Protect.b & 0xf0) != 0) {
  return 1
}

return 0

Actually I found other examples where BN automatically did that. For example:

uint32_t uMode = SetErrorMode(SEM_FAILCRITICALERRORS | SEM_NOOPENFILEERRORBOX)

SetErrorMode have a type like this: uint32_t SetErrorMode(enum THREAD_ERROR_MODE uMode). So I assume BN do this automatically if enumeration type is set. I tried to change the type of Protect from DWORD to PAGE_PROTECTION_FLAGS but it didn't work. Also I don't think that this should be the solution for this issue, instead, BN should be able to do it even if there is no enumeration type is set.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at the M shortcut's enumeration-setting path and compare its handling with the existing behavior for typed enumerations, using the PAGE_PROTECTION_FLAGS and SetErrorMode examples in the report. Done means an ORed constant value such as 0xf0 can be recognized as its constituent enumeration flags even when no enumeration type is assigned.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
reverse-engineering
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.